Bug 2269617 (CVE-2024-26130)

Summary:	CVE-2024-26130 python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, anthomas, bbuckingham, bcourt, bdettelb, btarraso, caswilli, crizzo, dfreiber, dnakabaa, doconnor, dranck, drow, ehelms, epacific, ggainey, gtanzill, haoli, hkataria, jajackso, jburrell, jcammara, jdobes, jhardy, jmitchel, jneedle, jobarker, joehler, jsamir, jsherril, jtanner, juwatts, jwong, kaycoth, kegrant, kholdawa, koliveir, kshier, lbrazdil, lcouzens, mabashia, mhulan, mminar, mskarbek, nmoumoul, omaciel, orabin, osousa, pbraun, pcreech, rbiba, rbobbitt, rchan, shvarugh, sidakwo, simaishi, smallamp, smcdonal, sskracic, stcannon, sthirugn, teagle, tfister, thavo, tmalecek, tpfromme, vkrizan, vkumar, yguenane, ytale, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cryptography 42.0.4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was discovered in python-cryptography. A NULL pointer dereference can be triggered when a PKCS#12 key and certificate do not match. Specifically, if the pkcs12.serialize_key_and_certificates function is called with a non-matching certificate and private key and an encryption algorithm with hmac_hash set, the Python process may crash, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2269618, 2269619
Bug Blocks:	2269615

Description Robb Gatica 2024-03-14 22:17:05 UTC

If pkcs12.serialize_key_and_certificates is called with both:
- A certificate whose public key did not match the provided private key
- An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process. This has been resolved, and now a ValueError is properly raised.

Affected versions: >= 38.0.0, < 42.0.4

Patched in: https://github.com/pyca/cryptography/pull/10423

References:
https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
https://github.com/pyca/cryptography/pull/10423
https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55

Comment 1 Robb Gatica 2024-03-14 22:24:20 UTC

Created python-cryptography tracking bugs for this issue:

Affects: fedora-all [bug 2269618]

Comment 9 errata-xmlrpc 2024-06-10 18:37:29 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781

Comment 10 errata-xmlrpc 2024-10-10 20:28:48 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.15 for RHEL 8

Via RHSA-2024:7987 https://access.redhat.com/errata/RHSA-2024:7987

Comment 11 errata-xmlrpc 2025-02-12 00:09:07 UTC

This issue has been addressed in the following products:

  RHUI 4 for RHEL 8

Via RHSA-2025:1335 https://access.redhat.com/errata/RHSA-2025:1335

Comment 14 errata-xmlrpc 2025-09-10 10:33:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:15608 https://access.redhat.com/errata/RHSA-2025:15608